v2.11.2 v0.0.19
qdm12/dnsSep 9, 2026 → Sep 10, 20261 day between releases
What's New
Projects are unrelated; one is a static analyzer, the other a site builder.
New Features
- Runnable server artifacts
- CSPRNG in plugin sandbox
- Managed media ingestion from plugins
- SSRF-safe fetch guard for storage uploads
- Improved site import handling for alt text and script order
Improvements
- Security improvements with CSPRNG
- Plugin SDK updates for managed media ingestion
- Improved site import handling
- Path containment logic fix
- Content access in manifest
Bug Fixes
- Fix path containment using relative() instead of string prefix
- Carry contentAccess from definePlugin config into manifest
- Repair e2e specs left behind by security fixes
- Keep content wrapped by compound button
Upgrade Notes
These releases belong to different repositories (SkillSpector and Instatic), so no upgrade guidance is applicable between them.
The Two Releases
SkillSpector v2.11.2
Sep 9, 2026· 1 month ago
Fixes fatal reference-accounting errors and several false static-parser limits triggered by ordinary documentation. This patch also preserves incomplete-analysis reporting when a runtime-selected executable prevents exact command reconstruction.
Full release notesInstatic 0.0.19
Sep 10, 2026· 1 month ago
This release includes a coordinated security update, introduces runnable server artifacts, and enhances plugin sandbox security and media handling capabilities.
Full release notes